Daniel Berger
2008-May-17 19:38 UTC
[Win32utils-devel] Problem reading log with win32-eventlog - buffer too small
Hi all, A user recently ran into an issue with win32-eventlog and the EventLog#read method when reading a saved log file. It seems that there''s an issue. After some experimentation I found that the problem seems to be that the initial buffer to ReadEventLog() in line 558 is too small, so it tries a second call to ReadEventLog() with a larger buffer. The problem is that, after I added some error checking code there, the second attempt returns: "The data area passed to a system call is too small" What I can''t figure out is why it''s failing. The buffer is plenty big, and I even tried setting it to the max value (0x7ffff bytes), but I still get that error. Any ideas? I''ve attached the log file in question. The error happens right after log entry 136. BTW, I''ve added some error handling in CVS, so please checkout the latest code. Regards, Dan -------------- next part -------------- A non-text attachment was scrubbed... Name: AppEvent.evt Type: application/octet-stream Size: 373748 bytes Desc: not available URL: <http://rubyforge.org/pipermail/win32utils-devel/attachments/20080517/82ff1deb/attachment-0001.obj>
Park Heesob
2008-May-18 02:26 UTC
[Win32utils-devel] Problem reading log with win32-eventlog - buffertoo small
Hi, ----- Original Message ----- From: "Daniel Berger" <djberg96 at gmail.com> To: "win32utils-devel" <win32utils-devel at rubyforge.org> Sent: Sunday, May 18, 2008 4:38 AM Subject: [Win32utils-devel] Problem reading log with win32-eventlog - buffertoo small> Hi all, > > A user recently ran into an issue with win32-eventlog and the > EventLog#read method when reading a saved log file. It seems that > there''s an issue. > > After some experimentation I found that the problem seems to be that the > initial buffer to ReadEventLog() in line 558 is too small, so it tries a > second call to ReadEventLog() with a larger buffer. The problem is that, > after I added some error checking code there, the second attempt returns: > > "The data area passed to a system call is too small" > > What I can''t figure out is why it''s failing. The buffer is plenty big, > and I even tried setting it to the max value (0x7ffff bytes), but I > still get that error. > > Any ideas? I''ve attached the log file in question. The error happens > right after log entry 136. >Modify #561-566 of eventlog.rb if GetLastError() == ERROR_INSUFFICIENT_BUFFER buf = (0.chr * buf.size) + (0.chr * needed.unpack(''L'')[0]) unless ReadEventLog(@handle, flags, offset, buf, size, read, needed) raise Error, get_last_error end end to if GetLastError() == ERROR_INSUFFICIENT_BUFFER buf = (0.chr * buf.size) + (0.chr * needed.unpack(''L'')[0]) size = buf.size unless ReadEventLog(@handle, flags, offset, buf, size, read, needed) raise Error, get_last_error end end It is a very simple but invisible bug :) Regards, Park Heesob
Daniel Berger
2008-May-18 02:54 UTC
[Win32utils-devel] Problem reading log with win32-eventlog - buffertoo small
Park Heesob wrote:> Hi, > ----- Original Message ----- > From: "Daniel Berger" <djberg96 at gmail.com> > To: "win32utils-devel" <win32utils-devel at rubyforge.org> > Sent: Sunday, May 18, 2008 4:38 AM > Subject: [Win32utils-devel] Problem reading log with win32-eventlog - buffertoo small > > >> Hi all, >> >> A user recently ran into an issue with win32-eventlog and the >> EventLog#read method when reading a saved log file. It seems that >> there''s an issue. >> >> After some experimentation I found that the problem seems to be that the >> initial buffer to ReadEventLog() in line 558 is too small, so it tries a >> second call to ReadEventLog() with a larger buffer. The problem is that, >> after I added some error checking code there, the second attempt returns: >> >> "The data area passed to a system call is too small" >> >> What I can''t figure out is why it''s failing. The buffer is plenty big, >> and I even tried setting it to the max value (0x7ffff bytes), but I >> still get that error. >> >> Any ideas? I''ve attached the log file in question. The error happens >> right after log entry 136. >> > Modify #561-566 of eventlog.rb > > if GetLastError() == ERROR_INSUFFICIENT_BUFFER > buf = (0.chr * buf.size) + (0.chr * needed.unpack(''L'')[0]) > unless ReadEventLog(@handle, flags, offset, buf, size, read, needed) > raise Error, get_last_error > end > end > to > if GetLastError() == ERROR_INSUFFICIENT_BUFFER > buf = (0.chr * buf.size) + (0.chr * needed.unpack(''L'')[0]) > size = buf.size > unless ReadEventLog(@handle, flags, offset, buf, size, read, needed) > raise Error, get_last_error > end > end > > It is a very simple but invisible bug :)Oh, that was silly of me. Wow, that''s been there a long time. I guess there aren''t many log entries over 64k. :) Many thanks, Dan